[% setvar title First-Class CGI Support %]
<div id="archive-notice">
    <h3>This file is part of the Perl 6 Archive</h3>
    <p>To see what is currently happening visit <a href="http://www.perl6.org/">http://www.perl6.org/</a></p>
</div>
<div class='pod'>
<a name='TITLE'></a><h1>TITLE</h1>
<p>First-Class CGI Support</p>
<a name='VERSION'></a><h1>VERSION</h1>
<pre>  Maintainer: Adam Turoff &lt;<a href='mailto:ziggy@panix.com'>ziggy@panix.com</a>&gt;
  Date: 24 Sep 2000
  Last Modified: 26 Sep 2000
  Mailing List: <a href='mailto:perl6-language@perl.org'>perl6-language@perl.org</a>
  Number: 288
  Version: 2
  Status: Frozen</pre>
<a name='ABSTRACT'></a><h1>ABSTRACT</h1>
<p>Perl is frequently used in CGI environments.  It should be as easy
to write CGI programs with perl as it is to write command line text
filters.  This means making Perl more aware of the nature of the
CGI invocation context, as well as the CGI output context.</p>
<p>This can be accomplished by adding a very simple pragma that
automatically turns on tainting and parses CGI GET/POST request
strings.  This rudimentary support for CGI programming does not
extend to including output formatters with this pragma.</p>
<p>It may make sense to expose this pragma through a hypothetical '-cgi'
command line option to Perl.</p>
<a name='DESCRIPTION'></a><h1>DESCRIPTION</h1>
<p>Tom Christiansen proposed this in his perl6storm message:</p>
<pre>	=item perl6storm #0025

	Make -T the default when operating in a CGI env.  That is, taintmode.
	Will this kill us?  Close to it.  Tough.  Insecurity through idiocy
	is a problem.  Make them *add* a switch to make it insecure, like
	-U, if that's what they mean, to disable tainting instead.</pre>
<p>and this:</p>
<pre>	=item perl6storm #0026

	Make CGI programming easier.  Make as first class as
	@ARGV and %ENV for CLI progging.</pre>
<p>Perl6 make it *easier* to write CGI programs than Perl5.</p>
<p>This should be accomplished by adding a 'use cgi;' pragma that
does the very basics for plugging Perl into a CGI invocation
context.  This pragma could be loaded through '#!/usr/bin/perl -cgi',
'#!/usr/bin/perl -Mcgi' or some other such flag.</p>
<p>To make CGI programming easier, this option/pragma should:</p>
<ul>
<li><a name='Turn on tainting'></a>Turn on tainting</li>
<li><a name='Parse the CGI GET/POST request, returning CGI variables into %CGI (regardless of the source) in an un-HTTP escaped fashion'></a>Parse the CGI GET/POST request, returning CGI variables into %CGI
(regardless of the source) in an un-HTTP escaped fashion</li>
<li><a name='Parse the incoming HTTP headers and deposit them into a %HTTP variable'></a>Parse the incoming HTTP headers and deposit them into a %HTTP variable</li>
<li><a name='Offer simple interfaces to set HTTP headers (e.g. content type, result codes)'></a>Offer simple interfaces to set HTTP headers (e.g. content type, result codes)</li>
<li><a name='Load quickly in standard forked CGI instances'></a>Load quickly in standard forked CGI instances</li>
<li><a name='Not take up gobs of memory'></a>Not take up gobs of memory</li>
</ul>
<p>This option/pragma should <b>NOT</b> load any content-generation interfaces.</p>
<p>Tainting should be able to be turned off, as Tom recommends,
but only if the user turns on the &quot;absolutely, positively,
do NOT turn on taint mode&quot; switch.</p>
<p>Nate Wiger pointed out that support for emitting HTTP
headers before content is ready for output would help Perl
&quot;do the right thing&quot;.  See the implementation section for details.</p>
<a name='IMPLEMENTATION'></a><h1>IMPLEMENTATION</h1>
<p>Write a very small cgi.pm pragma that does as little as possible,
perhasp based on Lincoln's code for parsing CGI contexts and
returning them into a hash.  This pragma should be loadable
through a very simple and obvious command line switch
(e.g. 'perl -cgi', 'perl -Mcgi', etc.)</p>
<p>Taint mode should be turned on when this module loads.  If
this not be easily accomplished thorugh a pragma, then the
pragma should be loaded through a command line switch that can
be processed when -T would be.</p>
<p>This pragma should create a %CGI variable, similar to %ENV
available as soon as the program starts executing.  This pragma
should also expose an array, such as @HTTP or @HEADERS, where
users can queue up header name/value pairs to be emitted prior
to the first print statement.</p>
<p>This module should also create a %HTTP variable, similar to %CGI,
that contains the contents of the HTTP header values.</p>
<p>When this pragma is loaded, it should replace the print coderef
with a function that will print out all headers in the @HEADERS
queue, print out the desired output, and restore the print coderef.
If the @HEADERS queue is empty, it should emit a standard
&quot;Content-type: text/html\n\n&quot; string before resuming normal printing.</p>
<p>No support is made for magical header types, such as expiry, cookie
or redirect headers.  That is left for other modules to implement.</p>
<a name='REFERENCES'></a><h1>REFERENCES</h1>
<p>CGI.pm</p>
<p>perl6storm</p>
</div>
